#!/usr/bin/env bash
set -euo pipefail

# Build and deploy osvauco-agent locally (bypasses Cloud Build VPC SC)

PROJECT="propane-will-491900-m5"
REGION="us-central1"
REPO="osvauco-repo"
SERVICE="osvauco-agent"
TAG="v3.6.0"  # or use a unique tag
FULL_IMAGE="${REGION}-docker.pkg.dev/${PROJECT}/${REPO}/${SERVICE}:${TAG}"

echo "=== 1. Configure Docker auth ==="
gcloud auth configure-docker ${REGION}-docker.pkg.dev --quiet

echo "=== 2. Build locally ==="
# Need a Dockerfile for the hub - check if one exists
if [[ -f Dockerfile ]]; then
  docker build -t "${FULL_IMAGE}" .
elif [[ -f agents/mcp_server/Dockerfile ]]; then
  # Use the MCP server Dockerfile if that's the hub
  docker build -t "${FULL_IMAGE}" -f agents/mcp_server/Dockerfile .
else
  echo "ERROR: No Dockerfile found for osvauco-agent"
  exit 1
fi

echo "=== 3. Push image ==="
docker push "${FULL_IMAGE}"

echo "=== 4. Deploy with pre-built image ==="
gcloud run deploy "${SERVICE}"   --image="${FULL_IMAGE}"   --region="${REGION}"   --service-account="jason-vauger@${PROJECT}.iam.gserviceaccount.com"   --set-env-vars="GOOGLE_GENAI_USE_VERTEXAI=true,GOOGLE_CLOUD_PROJECT=${PROJECT},GOOGLE_CLOUD_LOCATION=${REGION},SERVICE_URL=https://osvauco-agent-zjbqp3prqq-uc.a.run.app,OPAX_BASE_URL=https://opax.vauco.no"   --set-secrets="MCP_SECRET=mcp-server-key:latest"   --no-allow-unauthenticated   --port=8080   --memory=512Mi   --cpu=1   --min-instances=0   --max-instances=2   --quiet

echo "=== 5. Verify ==="
SVC_URL=$(gcloud run services describe "${SERVICE}" --region="${REGION}" --format='value(status.url)')
echo "Service URL: ${SVC_URL}"

echo "=== 6. Health check ==="
TOKEN=$(gcloud auth print-identity-token --impersonate-service-account=jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com --audiences="${SVC_URL}")
for i in {1..10}; do
  if curl -sf -H "Authorization: Bearer $TOKEN" "${SVC_URL}/"; then
    echo "✅ Deployment successful! Service is healthy."
    exit 0
  fi
  echo "Waiting for service... (${i}/10)"
  sleep 5
done

echo "❌ Health check failed after 10 attempts"
curl -s -H "Authorization: Bearer $TOKEN" "${SVC_URL}/" || true
exit 1